CVE-2017-16228
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-16228
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-16228.html
Vendor advisory: cve@mitre.org — https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
Vendor advisory: cve@mitre.org — https://www.dulwich.io/code/dulwich/
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 0.18.5-1 |
| debian | bullseye | fixed | 0.18.5-1 |
| debian | forky | fixed | 0.18.5-1 |
| debian | sid | fixed | 0.18.5-1 |
| debian | trixie | fixed | 0.18.5-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | dulwich | <0.18.5 | 0.18.5 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| dulwich_project | dulwich | {"endIncluding":"0.18.4"} | |
References
- https://tracker.debian.org/news/882440
- https://www.dulwich.io/code/dulwich/
- https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
- https://nvd.nist.gov/vuln/detail/CVE-2017-16228
- https://github.com/jelmer/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6
- https://github.com/jelmer/dulwich
- https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2017-12.yaml
- https://web.archive.org/web/20201220231743/https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6
- https://web.archive.org/web/20210128154006/https://www.dulwich.io/code/dulwich
- https://www.dulwich.io/code/dulwich
- https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6
- https://www.suse.com/security/cve/CVE-2017-16228.html
- https://security-tracker.debian.org/tracker/CVE-2017-16228
Verify integrity in audit chain (admin only). AS-IS.